Skip to main content
Xoxoday Loyalife engages third-party service providers to deliver platform functionality, with each provider contractually bound to process data only as instructed and in compliance with applicable data protection regulations.

​
How Xoxoday Loyalife Works With Third-Party Providers

Running an enterprise loyalty platform at scale requires specialized infrastructure and services. Xoxoday Loyalife partners with carefully selected third-party service providers for functions such as cloud hosting, email delivery, analytics, payment processing, and security monitoring. Each provider is assessed before engagement and operates under a formal Data Processing Agreement (DPA). Data shared with these providers is limited to what is strictly necessary for the service to function. Providers are prohibited from using customer data for their own commercial purposes, and Xoxoday Loyalife maintains an up-to-date record of sub-processors as part of its accountability obligations under GDPR and equivalent frameworks.

​
Categories of Third-Party Providers

Xoxoday Loyalife works with providers across several operational categories. Cloud infrastructure providers host and replicate data across secure regions. Communication services handle transactional notifications and reward delivery alerts sent to employees. Analytics and monitoring tools support platform reliability and performance without exposing personally identifiable information in raw form. Where Xoxoday Loyalife integrates with HR systems such as Workday, SAP SuccessFactors, or Darwinbox, those integrations are configured by the customer’s own IT team and governed by the customer’s own agreements with those vendors. Xoxoday Loyalife acts as the data processor in that context, not the controller.

​
Data Protection Commitments Across the Chain

Every third-party provider engaged by Xoxoday Loyalife is required to maintain security standards consistent with the platform’s own posture. Xoxoday Loyalife holds ISO 27001 certification and SOC 2 Type II attestation, and sub-processors are expected to meet equivalent or comparable controls relevant to the data they handle. Customers receive transparency into which sub-processors are in use through the DPA addendum included in enterprise agreements. If a new sub-processor is added that materially affects data handling, Xoxoday Loyalife provides advance notice so customers can assess impact before the change takes effect.

​
What This Means for Enterprise Buyers

For IT and compliance teams evaluating Xoxoday Loyalife, the sub-processor model is standard practice across enterprise SaaS. The key safeguard is contractual flow-down: obligations that Xoxoday Loyalife accepts from customers are passed down to the providers who process data on its behalf. This ensures the chain of accountability holds even when specialized vendors are involved in delivering specific platform capabilities. Customers operating under sector-specific regulation — such as financial services or healthcare — can request additional information about specific providers during the procurement process to satisfy their own vendor risk assessments. Learn more: Xoxoday Loyalife Help Centre — General

Data Processing Agreement overview

Understand how Xoxoday Loyalife structures DPAs and what protections apply to your data across the platform.

Security certifications and compliance

Review the ISO 27001 and SOC 2 Type II certifications that govern Xoxoday Loyalife’s security posture.